topic Re: SPAN in Network Security https://community.cisco.com/t5/network-security/span/m-p/391803#M99515 <HTML><HEAD></HEAD><BODY><P>Sure you can. Assuming your only want to monitor two physical ports, just have them both use the same destination port and you&#146;re good to go.</P><P></P><P>Info on configuring SPAN and RSPAN on a 2950 can be found here:</P><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/hw/switches/ps4916/products_configuration_guide_chapter09186a008017e528.html" target="_blank">http://www.cisco.com/en/US/products/hw/switches/ps4916/products_configuration_guide_chapter09186a008017e528.html</A></P><P></P><P>The only caveat is watch out for your aggregate throughput value. If you exceed the maximum throughput of the IDS, which is a mere 45 mbps for an IDS-4210 IIRC, you'll drop packets. If these are lower end links however, you should be OK.</P><P></P><P>I hope this helps,</P><P>Alex Arndt</P></BODY></HTML> Tue, 08 Mar 2005 15:56:45 GMT a.arndt 2005-03-08T15:56:45Z SPAN https://community.cisco.com/t5/network-security/span/m-p/391802#M99514 <P>Hello,</P><P>I want to monitor 2 vlans (Pix inside and Outside) with TCP Reset on the same switch 2950 and i have only one sensing interface on my sensor 4210 !</P><P>Is it possible to do that ?</P><P>Many thanks.</P> Sun, 10 Mar 2019 09:18:58 GMT https://community.cisco.com/t5/network-security/span/m-p/391802#M99514 christophe.fernandes 2019-03-10T09:18:58Z Re: SPAN https://community.cisco.com/t5/network-security/span/m-p/391803#M99515 <HTML><HEAD></HEAD><BODY><P>Sure you can. Assuming your only want to monitor two physical ports, just have them both use the same destination port and you&#146;re good to go.</P><P></P><P>Info on configuring SPAN and RSPAN on a 2950 can be found here:</P><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/hw/switches/ps4916/products_configuration_guide_chapter09186a008017e528.html" target="_blank">http://www.cisco.com/en/US/products/hw/switches/ps4916/products_configuration_guide_chapter09186a008017e528.html</A></P><P></P><P>The only caveat is watch out for your aggregate throughput value. If you exceed the maximum throughput of the IDS, which is a mere 45 mbps for an IDS-4210 IIRC, you'll drop packets. If these are lower end links however, you should be OK.</P><P></P><P>I hope this helps,</P><P>Alex Arndt</P></BODY></HTML> Tue, 08 Mar 2005 15:56:45 GMT https://community.cisco.com/t5/network-security/span/m-p/391803#M99515 a.arndt 2005-03-08T15:56:45Z